metasploit | f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33

General

Target

f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
Size

69KB
MD5

bc3812883dc8c0dc2e55f8a7aa6fe782
SHA1

cb61c72b438b5f4566c474a262518892521068cb
SHA256

f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33
SHA512

fafad395e94c0d647b00613dc91ddcdfd86ad2d0aa957f0c760330e02eecceb5367b34c4a4e77aef767bd6a059757c1cd83495f50c08c5219a8185ee7ae86cc0
SSDEEP

1536:Fq3ZufbLDnb+Qnu+LKaLrEStwqjWKNaXEl4He2C:s3ZufbnnbdLKWrzjvNaXc2

Score

10^/10

metasploit backdoor evasion persistence trojan upx

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
1760	winrsc.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/684-57-0x0000000029A00000-0x0000000029A2C000-memory.dmp	upx
behavioral1/memory/684-63-0x0000000029A00000-0x0000000029A2C000-memory.dmp	upx
behavioral1/memory/684-74-0x0000000029A00000-0x0000000029A2C000-memory.dmp	upx

Loads dropped DLL 6 IoCs

pid	Process
684	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
684	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
2028	WerFault.exe
2028	WerFault.exe
2028	WerFault.exe
2028	WerFault.exe

Windows security modification 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows System Monitor = "C:\\Windows\\system\\winrsc.exe"	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1584 set thread context of 684	1584	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe	28

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system\winrsc.exe	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
File opened for modification	C:\Windows\system\winrsc.exe	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	1760	WerFault.exe	29

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
Key created	\REGISTRY\USER\.DEFAULT	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	684	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 684	1584	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe	28
PID 1584 wrote to memory of 684	1584	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe	28
PID 1584 wrote to memory of 684	1584	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe	28
PID 1584 wrote to memory of 684	1584	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe	28
PID 1584 wrote to memory of 684	1584	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe	28
PID 1584 wrote to memory of 684	1584	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe	28
PID 684 wrote to memory of 1760	684	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe	29
PID 684 wrote to memory of 1760	684	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe	29
PID 684 wrote to memory of 1760	684	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe	29
PID 684 wrote to memory of 1760	684	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe	29
PID 1760 wrote to memory of 2028	1760	winrsc.exe	30
PID 1760 wrote to memory of 2028	1760	winrsc.exe	30
PID 1760 wrote to memory of 2028	1760	winrsc.exe	30
PID 1760 wrote to memory of 2028	1760	winrsc.exe	30
PID 684 wrote to memory of 1824	684	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe	31
PID 684 wrote to memory of 1824	684	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe	31
PID 684 wrote to memory of 1824	684	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe	31
PID 684 wrote to memory of 1824	684	f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe	31

C:\Users\Admin\AppData\Local\Temp\f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
"C:\Users\Admin\AppData\Local\Temp\f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Temp\f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe
  "C:\Users\Admin\AppData\Local\Temp\f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33.exe"
  2⤵
  - Modifies security service
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Windows\system\winrsc.exe
    "C:\Windows\system\winrsc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 120
      4⤵
      Loads dropped DLL
      Program crash
      PID:2028
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F18795~1.EXE > nul
    3⤵
    PID:1824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\winrsc.exe

Filesize
69KB

MD5
bc3812883dc8c0dc2e55f8a7aa6fe782

SHA1
cb61c72b438b5f4566c474a262518892521068cb

SHA256
f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33

SHA512
fafad395e94c0d647b00613dc91ddcdfd86ad2d0aa957f0c760330e02eecceb5367b34c4a4e77aef767bd6a059757c1cd83495f50c08c5219a8185ee7ae86cc0

Download Submit
\Windows\system\winrsc.exe

Filesize
69KB

MD5
bc3812883dc8c0dc2e55f8a7aa6fe782

SHA1
cb61c72b438b5f4566c474a262518892521068cb

SHA256
f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33

SHA512
fafad395e94c0d647b00613dc91ddcdfd86ad2d0aa957f0c760330e02eecceb5367b34c4a4e77aef767bd6a059757c1cd83495f50c08c5219a8185ee7ae86cc0

Download Submit
\Windows\system\winrsc.exe

Filesize
69KB

MD5
bc3812883dc8c0dc2e55f8a7aa6fe782

SHA1
cb61c72b438b5f4566c474a262518892521068cb

SHA256
f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33

SHA512
fafad395e94c0d647b00613dc91ddcdfd86ad2d0aa957f0c760330e02eecceb5367b34c4a4e77aef767bd6a059757c1cd83495f50c08c5219a8185ee7ae86cc0

Download Submit
\Windows\system\winrsc.exe

Filesize
69KB

MD5
bc3812883dc8c0dc2e55f8a7aa6fe782

SHA1
cb61c72b438b5f4566c474a262518892521068cb

SHA256
f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33

SHA512
fafad395e94c0d647b00613dc91ddcdfd86ad2d0aa957f0c760330e02eecceb5367b34c4a4e77aef767bd6a059757c1cd83495f50c08c5219a8185ee7ae86cc0

Download Submit
\Windows\system\winrsc.exe

Filesize
69KB

MD5
bc3812883dc8c0dc2e55f8a7aa6fe782

SHA1
cb61c72b438b5f4566c474a262518892521068cb

SHA256
f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33

SHA512
fafad395e94c0d647b00613dc91ddcdfd86ad2d0aa957f0c760330e02eecceb5367b34c4a4e77aef767bd6a059757c1cd83495f50c08c5219a8185ee7ae86cc0

Download Submit
\Windows\system\winrsc.exe

Filesize
69KB

MD5
bc3812883dc8c0dc2e55f8a7aa6fe782

SHA1
cb61c72b438b5f4566c474a262518892521068cb

SHA256
f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33

SHA512
fafad395e94c0d647b00613dc91ddcdfd86ad2d0aa957f0c760330e02eecceb5367b34c4a4e77aef767bd6a059757c1cd83495f50c08c5219a8185ee7ae86cc0

Download Submit
\Windows\system\winrsc.exe

Filesize
69KB

MD5
bc3812883dc8c0dc2e55f8a7aa6fe782

SHA1
cb61c72b438b5f4566c474a262518892521068cb

SHA256
f1879599f1fde03fa1f1db46364c2d0ff67e79507094f36b413790fe72159e33

SHA512
fafad395e94c0d647b00613dc91ddcdfd86ad2d0aa957f0c760330e02eecceb5367b34c4a4e77aef767bd6a059757c1cd83495f50c08c5219a8185ee7ae86cc0

Download Submit
memory/684-63-0x0000000029A00000-0x0000000029A2C000-memory.dmp

Filesize
176KB

Download
memory/684-61-0x0000000000400000-0x0000000000B6B000-memory.dmp

Filesize
7.4MB

Download
memory/684-57-0x0000000029A00000-0x0000000029A2C000-memory.dmp

Filesize
176KB

Download
memory/684-55-0x0000000029A00000-0x0000000029A2C000-memory.dmp

Filesize
176KB

Download
memory/684-74-0x0000000029A00000-0x0000000029A2C000-memory.dmp

Filesize
176KB

Download
memory/1584-54-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download
memory/1584-60-0x0000000000400000-0x0000000000B6B000-memory.dmp

Filesize
7.4MB

Download
memory/1760-75-0x0000000000400000-0x0000000000B6B000-memory.dmp

Filesize
7.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads